Process and device for control and monitoring a traffic control system

ABSTRACT

Process and device for controlling and monitoring of a traffic control system which has actuators and monitoring elements and by means of which at least two traffic tracks for railborne vehicles can be controlled by a control process which, upon request for allocation of a route, blocks all the actuators belonging to this route against other requests to create additional routes and control operations and carries out the request. To that effect, each of the changes in the positions or conditions of the actuators to be carried out by the control process, takes place only after successful testing for permissibility by a test process which is independent of the control process and which, in each case, tests whether the actuators and/or monitoring elements to be blocked or to be actuated for the allocation or release of the route already are in use and, thus, have been blocked.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention concerns a process and a device for controllingand monitoring of a traffic control system, and more particularly, to aprocess and device for controlling and monitoring railcars and railstherefor.

2. Discussion of Background Information

Various procedures are used in signal boxes to assign travel routes forrailroad traffic. Electronic signal boxes, working in accordance withthe principle of secured charts, have a memory in which all selectableroutes are recorded. German Patent Application No. DE-AS 10 30 383 (seealso DE-PS 35 35 785 C2, column 4, lines 38-47) describes an electronicsignal box in which the target loads of all travel route segments to beincluded in the individual travel routes are stored in a table providedin a memory. The signal orders for the individual travel route segmentsare derived from the deviations between target and actual loads. This,however, entails a large memory requirement, which increasessubstantially with the size of the system to be controlled. At largertrain stations, more than 50,000 start/finish combinations can beprogrammed under certain circumstances. In this process, in order toattain the necessary degree of safety, it is necessary to ensure thatall data relating to the selectively programmable travel routes havebeen correctly chosen and stored.

In order to guarantee the greatest possible degree of safety, however,electronic route interlocking stations are primarily in use today, suchas are described for example in German Patent No. DE-PS 32 32 308. Inthe course of the search for travel routes, data words for the computersmarked as start and end are entered into the networked multi-computersystem linked in accordance with the track diagram; during this process,data words are deposited for a great many switches, a large portion ofwhich will not be needed later. The unnecessary storing and deleting ofdata words in this electronic signal box leads to "superfluous"processing procedures, which assume unjustifiable proportions,particularly in complex systems.

To reduce costs, in a process known from German Patent No. DE-PS 35 35785 C2, target-group information is stored in track segments locatednear tapering switch points, which simplifies the search for travelroutes. However, the correct determination and decentralized storage ofinformation in the appropriate memory units entails a correspondingcost.

German Patent Publication No. DE 43 20 574 A1 describes a simplifiedmonitoring of a system controlled by an electronic signal box operatingaccording to the track diagram principle. Herein, individual partialcontrols are assigned to several track elements at the same time, inorder to become operative for them jointly with regard to clear reportsand releases. By this means, operational malfunctions are avoided whichcould otherwise arise as a result of unexpectedly occurring, differingwork conditions of the individual track segments. Even this advantageoussolution, however, is not suitable for bringing about a greatersimplification of the electronic signal box.

The observation of the required safety standards is also of importance.In DE-PS 32 32 308, any failures of the components, which can lead to achange in transferred data, are identified through the transfer andcomparison of exclusive-OR data words. This, however, leads toadditional cost, without a comprehensive safety test being performedthereby.

It is known from German Patent Publication No. DE-AS 24 02 875 thatprotection from processing errors can be obtained when all importantcommands pertaining to safety are processed through two independent waysat practically double cost, where, in operation with only one computer,the double processing of commands is performed with two differentprograms and an interposed command verification program, through whichthe processed orders are compared.

Further, European Patent No. EP 0 683 082 A1 describes a device in whichthe operator of a control system is almost completely freed ofmonitoring tasks. Here, previously programmed combinations of switchconditions are read out by an indicating device and tested forcompatibility with rules of logic stored in a data processing system.These rules of logic are to be prepared during the designing of a signalbox and tested for accuracy. In order to guarantee comprehensive safety,error-free rules of logic must be provided at great cost for all switchconditions which might arise.

SUMMARY OF THE INVENTION

The object of the present invention is therefore to present a processfor control and monitoring of a traffic control system having actuatorsand monitoring elements, by means of which at least two tracks forrailborne vehicles can be controlled at low cost while meeting stringentsafety requirements. Further, a traffic control system operating inaccordance with the inventive process, which can be designed at low costand which guarantees a high safety standard, is to be created.

This object is attained by the present invention.

The process in accordance with the invention permits the simple designof traffic systems, in particular of electronic signal boxes in railroadtechnology. The use of two independent methods for control andregulation results in lower costs for the design of the system and atthe same time in increased operational safety. Upon request forallocation of a travel route, all actuators corresponding to this travelroute are blocked, by a control process, against other requests toassign further travel routes and control operations, and are actuatedaccordingly, where each of the changes in the positions or conditions ofthe actuators to be performed by the control process takes place onlyafter successful testing for permissibility by a test process which isindependent of the control process. Thus, the control process can berealized at a lower cost since the proof of safety is carried out on thebasis of a diversity check for permissibility of the changes in thepositions or conditions of the actuators by a test process that isindependent of the control process.

The allocation and possibly also the release route initiated by thecontrol process according to the secured chart principle are monitoredby the test process according to the track diagram principle, in thateach case is tested as to whether the actuators and/or monitoringelements to be blocked and actuated are being used for a previouslyallocated travel route, and are thus already blocked.

The control process preferably works according to the secured chartprinciple. The allocation and possibly also the release of the travelroute initiated by the control process according to the secured chartprinciple are monitored by the test process, in this case according tothe track diagram principle, in that each case is tested as to whetherthe actuators and/or monitoring elements to be blocked and actuated arebeing used for a previously allocated travel route, and are thus alreadyblocked.

The control process according to the secured chart principle can bedesigned easily by constructing a table in which are entered thepositions and conditions of the actuators provided for the individualtravel routes. The travel routes thus can be switched easily, whicheliminates a costly travel route search according to the track diagramprinciple with the problems described above. For verification of thepositions and conditions designated by the control process for theactuators is performed advantageously in accordance with the trackdiagram principle, through which all positions and conditions of theactuators blocked for other travel routes are taken into consideration.Thus the positions and conditions to be switched are not tested on thebasis of numerous rules of logic prepared in advance, but rather on thebasis of the actually existing condition of the entire system. Anincreased operational safety results from this comprehensive test.Furthermore, the test in accordance with the track diagram principletakes place at low cost, since the correct and complete preparation oftest rules for programming the travel routes, which is costly, iseliminated.

The use of modern control technology, in particular, also makes itpossible to realize the control process according to the track diagramprinciple at reduced cost. To guarantee the required safety the testprocess, which is independent of the control process, is in this caseperformed according to the secured chart principle. The measures inaccordance with the invention thus make it possible to realize a systemcontrol based on two independent processes, tailored to a planned railtopology and a required level of safety, with the least possible cost.The control process is preferably realized in smaller systems accordingto the secured chart principle and in larger systems according to thetrack diagram principle. Relatively high costs for the realization ofthe control process are eliminated, however, because the required proofof safety can be met more easily through the use of the test processindependent of the control process.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention is explained in greater detail with the aid of thedrawings in the following examples. Herein,

FIG. 1 shows a railroad system with two parallel tracks, which can beconnected to each other via two connecting tracks and two switches each,

FIG. 2 shows the track diagram of the system in accordance with FIG. 1,

FIG. 3 shows the track diagram of a prepared travel route from C to B,and

FIG. 4 shows the track diagram of a prepared travel route from A to D.

DETAILED DESCRIPTION OF THE PRESENT INVENTION

FIG. 1 shows a railroad system with two parallel tracks GL1, GL2 goingfrom A to B or from C to D which can be connected to one another by twoconnecting tracks GL12, GL21 and two switches W1, W3 or W4, W2 which areattached to each of these connecting tracks GL12, GL21. The tracks GL1,GL2 are divided into different segments, which are monitored by theclear-signal indicators FM1, . . . , FM14. The track segments around theswitches W1, . . . W4 up to the middle of the corresponding connectingtracks GL12, GL21 are monitored by the clear-signal indicators FM3, FM5,FM10 and FM12. Provided following the segments associated with theclear-signal indicators FM1, FM7, FM8, and FM14 are signals S1, S4, S5,or S8. Assigned to the segments associated with the clear-signalindicators FM4 and FM11 are the signals S2 and S3 or S6 and S7.

The following travel routes can be set between points A, B, C and D,departing from point A or point C (excluding shunt routes):

Travel route 1 From A to B via track GL1,

Travel route 2 From A to B via track GL1, connecting track GL12, trackGL2, connecting track GL21, and track GL1,

Travel route 3 From A to D via track GL1, connecting track GL12 andtrack GL2 (see FIG. 4),

Travel route 4 From C to D via track GL2, and

Travel route 5 From C to B via track GL2, connecting track GL21 andtrack GL1 (see FIG. 3).

At the request for allocation of a travel route (for example travelroute 1), a control process blocks all actuators associated with thisroute against other requests for the allocation of additional travelroutes (for example, one of the travel routes 2,3,4 or 5) and controloperations, and actuates them accordingly. Each of the changes in thepositions or conditions of the actuators to be performed by the controlprocess takes place only after successful testing for permissibility bya test process which is independent of the control process. Monitoringof the allocation and possibly also the release of the travel routeinitiated by the control process according to the secured chartprinciple is done by the test process according to the track diagramprinciple, in that each case is tested as to whether the actuatorsand/or monitoring elements to be blocked and actuated are being used fora previously allocated travel route, and are thus already blocked.

For travel routes 1, . . . , 5 the track segments S1, . . . S8, W1, . .. W4, FM1, . . . FM14 are in the conditions listed in Table 1 below.This Table 1 corresponds to the table described in DE-AS 10 30 383, inwhich the target loads of all travel route segments to be included inthe various travel routes are stored. Travel routes 1, . . . 5 can thusbe set by means of a control process.

                  TABLE 1                                                         ______________________________________                                                Travel   Travel   Travel Travel Travel                                (Element)                                                                             route 1  route 2  route 3                                                                              route 4                                                                              route 5                               ______________________________________                                        S1      Go       Go       Go     any    any                                   S2      Stop     Stop     Stop   any    any                                   S3      Go       Stop     any    any    Stop                                  S4      Stop     Stop     any    any    Stop                                  S5      any      Stop     Stop   Go     Go                                    S6      any      Stop     Stop   Stop   Stop                                  S7      any      Go       Go     *Go    Go                                    S8      any      Stop     Stop   Stop   Stop                                  W1      straight diverted diverted                                                                             straight                                                                             straight                              W2      straight diverted straight                                                                             straight                                                                             diverted                              W3      straight diverted diverted                                                                             straight                                                                             straight                              W4      straight diverted straight                                                                             straight                                                                             diverted                              FM1     clear    clear    clear  any    any                                   FM2     clear    clear    clear  any    any                                   FM3     clear    clear    clear  any    any                                   FM4     clear    any      any    any    any                                   FM5     clear    clear    any    any    clear                                 FM6     clear    clear    any    any    clear                                 FM7     clear    clear    any    any    clear                                 FM8     any      any      any    clear  clear                                 FM9     any      any      any    clear  clear                                 FM10    any      clear    clear  clear  clear                                 FM11    any      clear    clear  clear  clear                                 FM12    any      clear    clear  clear  clear                                 FM13    any      any      clear  clear  any                                   FM14    any      any      clear  clear  any                                   ______________________________________                                    

To ensure a required safety standard for signal boxes working accordingto the secured chart principle, such as are known from DE-AS 10 30 383,very high safety standards must be chosen in particular in thepreparation of the software. The so-called Software Integrity Level isdetermined by a process named in European Norm EN 50 126. In thiscontext, the various risk factors (dangers to human life, dangers tohuman health, ecological dangers, dangers to goods) must be taken intoconsideration. The following Software Integrity Levels are defined asfollows in said standard:

                  TABLE 2                                                         ______________________________________                                        Software Integrity Level                                                                           Software Integrity                                       ______________________________________                                        4                    very high                                                3                    high                                                     2                    medium                                                   1                    low                                                      0                    non safety related                                       ______________________________________                                    

Known signal boxes operating in accordance with the secured chartprinciple must therefore be designed and executed at great expense inconsideration of the highest Software Integrity Level in accordance withEuropean Norm EN 50128. In train stations with a relatively large numberof travel routes, the result is thus an enormous expense for these knownsignal boxes.

Therefore, in accordance with the invention it is ensured that the riskfactors to be considered in the design of a signal box operatingaccording to the combined secured chart and track diagram principles canbe lowered a safety level, so that the software necessary for thecontrol process, while maintaining the required safety standards, can beprepared at a low Software Integrity Level for signal boxes and thus atlow expense.

Each change in the positions or conditions of the actuators to beperformed by the control process according to the secured chartprinciple thus takes place only after successful testing forpermissibility by a test process which is independent of the controlprocess. It is known from Norm EN 50128, section B, 17 or from DE-AS 2402 875, that protection from processing errors can be achieved when allcommands important for safety are processed through two independentpathways, where, in operation with only one computer, the doubleprocessing of commands is performed with two different programs and aninterposed command verification program, through which the processedorders are compared. Because the independent test process worksaccording to the track diagram principle, a diversity check of thepermissibility of the changes in the positions or conditions of theactuators is present. Instead of processing a control command at greatcost through two independent pathways, a command is processed accordingto the secured chart principle and an independent test is performedaccording to the track diagram principle. The test according to thetrack diagram principle guarantees a high degree of safety, as is known.Since the travel route search and process control according to the trackdiagram system are eliminated, the result is a low cost for the designand implementation of the test process. Monitoring of the allocation andpossibly also the release of the travel route initiated by the controlprocess according to the secured chart principle is done by the testprocess according to the track diagram principle, in that each case istested as to whether the actuators and/or monitoring elements to beblocked and actuated are being used for a previously allocated travelroute, and are thus already blocked.

The control process and the test process independent thereof can becontrolled by software that is stored in computers operating in parallelor separately, or in only one single computer. It will be assumed in thefollowing for the sake of simplicity that, as shown in FIG. 1, thecontrol process is controlled by a control process computer PR1 and thetest process by a test process computer PR2. The control processcomputer PR1 has a memory which among other things serves to store thedata of the secured chart. The test process computer PR2 has a memorywhich among other things serves to store the assigned travel routes andpreferably also to store the track diagram of the monitored routenetwork. The control of the actuators and the monitoring of theconditions of the track segments is performed as in the signal boxesknown from prior art.

When travel route 1 is set by the control process, all correspondingactuators are blocked against other requests for travel routes andcontrol operations. If travel route 5 has already been assigned, theconditions of the track segments associated with travel route 5 arestored in the test process computer PR2. The control process is able toassign the travel routes automatically. To guarantee the necessarysafety, all control commands generated by the control process accordingto the secured chart principle are verified, element by element, in thetest process according to the track diagram principle on the basis ofthe actual position of the actuators and the existing information fromthe monitoring elements and are tested, taking into consideration thetravel routes already assigned, in particular regarding incompatibletravel routes and needed flank protection, and cleared if no conflictsare discovered. If, however, an error occurs in the control process and,for instance, Signal S3 should be set on Go, even though Signal S3 isset on Stop for the previously programmed travel route (see Table 3),this will be discovered immediately by the test process on the basis ofthe conditions contained in the test computer for the track segmentsassociated with travel route 5, whereupon the control process is haltedand an error is reported.

                  TABLE 3                                                         ______________________________________                                                   Travel route 1                                                                            Travel route 5                                         ______________________________________                                        S3 (element) Go            Stop                                               ______________________________________                                    

Furthermore, it can also be determined by means of the test processwhether the flank protection for the assigned travel route is secured.In travel route 5 shown in FIG. 3, flank protection is secured by SwitchW1, and Signals S3 and S8. For this purpose, Switch W1 is blocked in thecondition "straight" and Signals S3 and S8 in the condition "Stop." Intravel route 3, shown in FIG. 4, flank protection is secured by SignalsS2, S5 and S4. Signals S3 and S8 are blocked in the condition "Stop."Before a travel route can be cleared, the test process can once againdetermine whether conflicts with other travel routes or regulationsexist. After a travel route is cleared (for instance, travel route 1 iscleared after release of travel route 5), its data are stored in thememory of test process computer PR2 and used to double-check the actionsof the control process.

After a command to assign a travel route is successfully executed, thecontrol process could, for example, determine whether the elementslisted in the corresponding rows of the secured chart (Table 1) are usedfor other routes, reserved, or cleared for switching (the controlprocess thus does not see a route, but rather the arbitrarily arrangedsegments of a row of the secured chart). As soon as all the units of arow of the secured chart are cleared and reserved for assigning a newroute, a double-checking according to the track diagram principle takesplace. The test process, working according to the track diagramprinciple, makes use here of the data on the track topology at least forevery assignable route. The double-checking can be performed at greateror lesser expense. For instance, only the alterations planned by thecontrol process will be tested as to whether they lead to a correctassignment of the route. If, for example, an incorrect setting isplanned for a switch, this will not be recognized by the controlprocess, which has no knowledge of the topology of the track network andthe routes. The problem will be recognized easily by the test process,functioning independently of the control process and according to thetrack diagram principle, because the track is interrupted between itsend points due to the faulty setting of the switch. Likewise, anincomplete setting can be recognized, where applicable . On a furtherlevel, the test process can even test further basic requirements, forexample flank protection, maximum permissible speed, etc.

The test preferably takes place, as described in the above paragraph,after all units listed in a row of the secured chart have been reserved.After successful testing, the route is assigned as a whole. It isfurthermore possible to perform the test before changing each individualunit.

In a preferred embodiment of the invention, the test process operatingaccording to the track diagram principle is linked to a list ofparameters, which permits the double-checking of customer-specificsettings that are to be performed by the control process and areindependent of the topology of the routes to be assigned (for example, adecentrally-positioned signal lamp is to be incorporated into a routeserving express train traffic). The signal lamp thus becomes an elementin the corresponding row of the secured chart and is monitored by thetest process with the aid of the list of parameters.

As described at the outset, the control process is realized more easilyby the secured chart principle in small systems, and by the trackdiagram principle in larger systems (accordingly, the test process isrealized by means of the track diagram or, respectively, the securedchart principle). In between is a zone in which the control process canbe realized according to the secured chart principle or the trackdiagram principle with little difference in regard to the cost. Itshould be noted, however, that systems have the tendency to grow andthat products are supposed to exhibit a gradually increasing performancecapacity with each generation. The choice of principle by which torealize the control process is therefore to be decided from case to caseand under consideration of the existing basic requirements and theprepared development prognosis.

Thus, the performance capacity of both processes should preferably betailored to each other with consideration for the totality of safetyrequirements to be met. For example, the performance capacity of thecontrol process can be reduced in regard to the meeting of the safetyrequirements, if a correspondingly greater performance capacity isselected for the test process.

Thus, the system structure of both processes should preferably bemodular so that they can be tailored appropriately to the totality ofsafety requirements to be met at little cost.

What is claimed is:
 1. A process for controlling and monitoring of atraffic control system, the system having actuators, monitoring unitsand at least two tracks for rail vehicles, comprising:blocking, by acontrol process, all of a plurality of actuators corresponding to arequested travel route against further requests to allocate furthertravel routes and further control operations, upon request forallocation of a requested travel route; testing, by a test process,whether one of the actuators and monitoring units to be blocked andactuated for the allocation and release of a requested travel route, arebeing used for a previously allocated requested travel route, and arethus already blocked, the test process being independent of the controlprocess; and setting each actuator in correspondence with the requestedtravel route.
 2. The process for controlling and monitoring of a trafficcontrol system according to claim 1, wherein the system furthercomprises switches that are controlled by the control process, theswitches automatically seeking flank protection.
 3. The process forcontrolling and monitoring of a traffic control system according toclaim 1, wherein the control process operates according to one of atrack diagram principle and a secured chart principle.
 4. The processfor controlling and monitoring of a traffic control system according toclaim 1, wherein the test process operates according to one of a trackdiagram principle and a secured chart principle.
 5. The process forcontrolling and monitoring of a traffic control system according toclaim 4, further comprising:verifying, element by element, in the testprocess according to the track diagram principle, all control commandsgenerated by the control process according to the secured chartprinciple, said verification being performed on the basis of the actualpositions of the actuators and the existing information from themonitoring elements; testing possible conflicts with at least one ofalready assigned travel routes and needed flank protection; evaluatingpredefined criteria in the testing process, the criteria comprising thetravel route to be assigned; and clearing the control commands if noconflicts are discovered.
 6. The process for controlling and monitoringof a traffic control system according to claim 4, furthercomprising:verifying all control commands generated by the controlprocess according to the secured chart principle, in the test processaccording to the track diagram principle, element by element, on thebasis of the actual positions of the actuators and the existinginformation from the monitoring elements; testing possible conflictswith at least one of already assigned travel routes and needed flankprotection; evaluating at least one of travel routes already assigned,incompatible travel routes, and needed flank protection; and clearingthe control commands if no conflicts with the evaluated travel routesand needed flank protection are discovered.
 7. The process forcontrolling and monitoring of a traffic control system according toclaim 6, further comprising:storing the data for the travel routecleared by the test process in a memory controlled by the test process,the memory containing data of previously assigned travel routes; andusing the data for the travel route cleared by the test process to checkfurther travel routes to be assigned.
 8. The process for controlling andmonitoring of a traffic control system according to claim 7, comprisingdeleting a travel route recorded in the memory, element-by-element,using standard release as the elements become cleared by the testprocess, after a vehicle for which the travel route was assigned haspassed the cleared elements.
 9. The process for controlling andmonitoring of a traffic control system according to claim 1, wherein thetest by the test process takes places as a whole after one of:a)blocking all control units, and b) blocking each individual control unitbefore changing each individual control unit.
 10. The process forcontrolling and monitoring of a traffic control system according toclaim 1, wherein the setting of each actuator in correspondence with therequested travel route occurs only after the test process successfullytests for the permissibility of each setting.
 11. The process forcontrolling and monitoring of a traffic control system according toclaim 10, wherein the test process operates according to the trackdiagram principle, the process for controlling and monitoring of atraffic control system further comprising a list of parameters, the listof parameters serving to check settings which are not directly connectedwith the track to be assigned.
 12. The process for controlling andmonitoring of a traffic control system according to claim 1 furthercomprising performing said testing in accordance with safety regulationsof railroad technology.
 13. The process for controlling and monitoringof a traffic control system according to claim 1, furthercomprising:monitoring, by the control process, the establishment of therequested travel route; and releasing, by the control process, theactuators for release of the requested travel route.
 14. A device forcontrolling and monitoring of a traffic control system, the systemhaving actuators, monitoring units and at least two tracks for railvehicles, the device comprising:a control process system configured tooperate a control process, the control process adapted to block all of aplurality of actuators corresponding to a requested travel route againstfurther requests to allocate further travel routes and further controloperations, upon request for allocation of a requested travel route; atest process system configured to operate a test process, the testprocess system being independent of said control process system; and acontroller adapted to control said control process system and said testprocess system.
 15. The device for controlling and monitoring of atraffic control system according to claim 14, wherein said controller isstored in a plurality of computers operating in parallel.
 16. The devicefor controlling and monitoring of a traffic control system according toclaim 14, wherein said controller is stored in a plurality of computersoperating independently.
 17. The device for controlling and monitoringof a traffic control system according to claim 14, wherein saidcontroller is stored in a single computer.
 18. The device forcontrolling and monitoring of a traffic control system according toclaim 14, wherein the control process system is adapted to operateaccording to one of a track diagram principle and a secured chartprinciple.
 19. The process for controlling and monitoring of a trafficcontrol system according to claim 14, wherein the test process system isadapted to operate according to one of a track diagram principle and asecured chart principle.
 20. The device for controlling and monitoringof a traffic control system according to claim 14, further comprising:acontrol process computer adapted to control said control process system;and a test process computer adapted to control the test process system.21. The device for controlling and monitoring of a traffic controlsystem according to claim 20, further comprising:a memory located withinsaid control process computer adapted to store a secured chart; and amemory located within said test process computer adapted to storeassigned travel routes.
 22. The device for controlling and monitoring ofa traffic control system according to claim 21, wherein said memorylocated within said test process computer is further adapted to store atrack diagram of a monitored route network.
 23. The device forcontrolling and monitoring of a traffic control system according toclaim 21, wherein said memory located within said control processcomputer is further adapted to store a track diagram of a monitoredroute network.
 24. The device for controlling and monitoring of atraffic control system according to claim 20, further comprising:amemory located within said control process computer adapted to storedata of a secured chart; and a memory located within said test processcomputer adapted to store assigned travel routes.
 25. The device forcontrolling and monitoring of a traffic control system according toclaim 24, wherein said memory located within said test process computeris further adapted to store a track diagram of a monitored routenetwork.
 26. The device for controlling and monitoring of a trafficcontrol system according to claim 20, further comprising:a memorylocated within said test process computer adapted to store data of asecured chart; and a memory located within said control process computeradapted to store assigned travel routes.
 27. The device for controllingand monitoring of a traffic control system according to claim 26,wherein said memory located within said control process computer isfurther adapted to store a track diagram of a monitored route network.28. The device for controlling and monitoring of a traffic controlsystem according to claim 14, the test process system being adapted totest the permissibility of each setting of each actuator incorrespondence with the requested travel route only after the testprocess successfully tests for the permissibility of each setting.